CVE-2026-44654
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, a shared-agent editor can delete file records through `DELETE /api/files` that the owner has reused across multiple agents. The deletion removes the file globally — not just from the shared agent — breaking the owner's other private agents that reference the same `file_id`. The private agent retains a stale `file_id` reference that no longer resolves. A shared-agent editor can destroy files that the owner uses across multiple agents. The owner's private agents — which the attacker has no access to — break silently with stale `file_id` references. This is a cross-agent integrity violation: editing access to one agent should not affect another. Version 0.8.4 contains a patch.
Risk Assessment
The risk is a cross-agent integrity violation where an editor with access to one agent can destroy files used by other agents, breaking functionality without direct access.
Recommendation
Upgrade LibreChat to version 0.8.4 or later, which includes a fix.
Other vulnerabilities in LibreChat
See all- CVE-2025-69220High
LibreChat version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. An authenticated attacker with access to the agent ID can change the behavior of arbitrary agents by uploading new files, even without permissions for that agent. Fixed in version 0.8.2-rc2.
- CVE-2026-32625Critical
LibreChat up to version 0.8.3 has a vulnerability in the MCP server integration that resolves ${VAR} placeholders from process.env during Zod schema validation of user-supplied MCP URLs. An authenticated user can create a malicious MCP configuration that sends critical secrets (CREDS_KEY, CREDS_IV, JWT_SECRET, MONGO_URI) to an attacker-controlled server.
- CVE-2026-22252Critical
LibreChat prior to v0.8.2-rc2 has a vulnerability in the MCP stdio transport that accepts arbitrary commands without validation, allowing any authenticated user to execute shell commands as root inside the container through a single API request. This vulnerability is fixed in v0.8.2-rc2.
- CVE-2025-69222Critical
LibreChat version 0.8.1-rc2 is prone to SSRF due to missing restrictions in the Actions feature by default. Agents can access internal services like the RAG API in the default Docker Compose setup.
- CVE-2026-54040Medium
A vulnerability in LibreChat prior to 0.8.4-rc1 allows an attacker with a stolen session token to regenerate all 2FA backup codes without requiring any TOTP token or existing backup code. This enables bypassing 2FA login or disabling 2FA entirely.
- CVE-2026-54037Medium
A vulnerability in LibreChat prior to 0.8.4-rc1 allows an authenticated user to bypass rate limiters added for the /fork endpoint by using the /duplicate endpoint, which performs the same expensive database operations but lacks any rate limiter. This can lead to server resource exhaustion.
- CVE-2026-54033High
LibreChat before version 0.8.4-rc1 allows authenticated users to set a custom URL for OpenAI-compatible API endpoints. This URL is used to construct HTTP requests without any SSRF validation, enabling traffic to be directed to internal network addresses.
- CVE-2026-54030High
A vulnerability in LibreChat before version 0.8.5 allows a malicious MCP server to steal access tokens intended for a legitimate server. The MCP OAuth implementation does not validate that the resource parameter from OAuth Protected Resource metadata (RFC 9728) matches the configured MCP server URL.
- CVE-2026-54029Medium
A vulnerability in LibreChat before version 0.8.4-rc1 allows any authenticated user to delete any other user's messages. The delete endpoint lacks a user constraint, enabling an attacker to use their own conversation ID and the victim's message ID to permanently remove messages.
- CVE-2026-54025Medium
LibreChat prior to version 0.8.4-rc1 has a vulnerability due to missing HTML escaping of double-quote characters in image alt text in Markdown. An attacker can inject malicious HTML code that executes in the victim's browser.
Original NVD description (English source)
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, a shared-agent editor can delete file records through `DELETE /api/files` that the owner has reused across multiple agents. The deletion removes the file globally — not just from the shared agent — breaking the owner's other private agents that reference the same `file_id`. The private agent retains a stale `file_id` reference that no longer resolves. A shared-agent editor can destroy files that the owner uses across multiple agents. The owner's private agents — which the attacker has no access to — break silently with stale `file_id` references. This is a cross-agent integrity violation: editing access to one agent should not affect another. Version 0.8.4 contains a patch.